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ACHIEVING  RELIABLE  INFORMATION  FROM 
EXTENSIVE  SENSOR  CLUSTER  NETWORKS  ON  SHIPS 


Abstract 

This  report  is  the  result  of  a  study  that  seeks  to  provide  guidelines  for 
obtaining  reliable  information  from  a  sensor  network  that  frequently  or 
continuously  monitors  the  interior  status  of  a  ship.  It  complements  other  reports 
in  preparation  from  NRL.  Approaches  include  built-in  test  (BIT)  and  built-in- 
calibration  (BIC)  but  they  have  drawbacks.  The  primary  finding  and 
recommendation  of  this  study  is  that  redundancy  is  feasible  and  is  the  most  cost 
effective  route  for  achieving  reliable  sensor  data. 


1.  Introduction 

The  original  goal  of  this  project  was  to  develop  and  demonstrate  a  systems 
approach  to  calibration  of  the  proposed  network  of  MEMS  sensors  that  will 
monitor  a  ship’s  condition,  and,  by  so  doing,  enable  a  significant  reduction  in  the 
size  of  the  ship’s  crew. 

In  order  to  produce  a  plan  for  calibration  of  the  sensors  on  the  SC-21, 
information  presently  available  about  the  types  of  sensors  to  be  used  and  their 
characteristics  is  being  assembled  by  NWAD.  Once  the  up-to-date  overall  picture 
of  the  sensor  arrays  was  in  hand,  then  a  plan  for  sensor  calibration  could  be 
formulated. 

In  formulating  this  program,  it  was  thought  that  the  calibration  plan  would 
break  down  the  following  way,  depending  on  the  findings  of  the  initial  study: 

a. )  determine  if  a  sensor  is  already  accurate  and  contains  sufficient  built-in 
calibration  that  can  be  interrogated  remotely  by  computer  and,  therefore,  is 
approved  for  use; 

b. )  encourage  meuiufacturers  of  particular  MEMS  sensors  to  make  design 
changes  (mechanical  or  electrical  in  nature)  in  order  to  ensure  that  the 
MEMS  device  will  have  built  in  calibration; 

c. )  if  (a.)  and  (b.)  are  not  possible,  recommend  inexpensive  means  to 
calibrate  the  sensor  which  may  entail  manufacture  of  a  new  MEMS  device 
for  calibration  purposes,  or  modification  of  ship  design  to  accommodate 
sensor  calibration. 
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This  study  would  help  ensure  that  the  latest  thinking  regarding  the  SC-21  design 
and  the  most  up-to-date  MEMS  technology  are  incorporated  into  the  program. 

As  NRL  began  to  execute  this  plan,  it  quickly  became  apparent  that  the 
entire  notion  of  calibration  of  MEMS  devices  was  mismatched  with  the 
advantages  MEMS  devices.  That  is,  the  key  issue  is  really  sensor  "reliability"  and 
not  "calibration"  per  se.  In  fact,  calibration  is  not  the  only  way  to  insure 
reliability,  and  it  may  not  even  be  the  optimum  method.  The  reasons  for  this  are 
detailed  in  what  follows.  Part  of  the  motivation  for  this  change  in  thinking  came 
directly  from  contacts  with  MEMS  manufacturers  who  do  not  presently  have 
built-in-calibration  and  are  not  anticipating  implementing  it  in  the  near  future. 
The  same  fundamental  factors  should  apply  to  all  programs  that  intend  to  install 
large  numbers  of  sensors  on  ships  including;  reduced  manning  ships  by  virtual 
presence  (RSVP),  condition-based  maintenance  (CBM),  integrated  condition 
assessment  system  (ICAS),  the  damage  control-automation  for  reduced 
maintenance  (DC-ARM)  programs,  among  others. 

In  order  to  understand  the  logic  in  recommending  this  change  in  emphasis 
of  the  BIC-MEMS  program,  we  first  present  an  general  review  the  various  ways 
to  perform  in-service  calibration  of  MEMS  sensor  packages. 
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2.  In-^Service  Calibration  and  Test  of  MEMS  Sensors 

In  principle  there  is  only  one  NIST-traceable  standard  that  can  be 
transferred  to  a  remote  sensor  via  a  network,  and  that  standard  is  “time”  (or  time 
interval).  All  the  rest  (acceleration,  force,  pressure,  voltage,  current,  resistance, 
etc.)  require  that  a  known  input  (a  traceable  standard)  be  present  in  order  to 
perform  a  calibration  (test  measurements  with  known  inputs).  This  limitation  is 
not  just  a  question  of  engineering,  it  is  a  fundamental  physical  limitation.  In  most 
cases  providing  a  traceable  standard  at  each  sensor  is  unreasonable,  impractical, 
or  impossible. 

The  next  best  solution  to  traceable  calibration  is  to  provide  a  stimulant  to  a 
standard.  For  example,  a  sensor  could  use  internal  or  external  circuits  and/or 
actuators  to  supply  highly  reproducible  forces,  voltages,  etc.  to  a  sense  element, 
and  then  measure  changes  in  the  health  of  the  sensor  by  examining  the  output. 
This  is  really  a  self-test  function  and  not  a  true  calibration.  However,  with  this 
self-test  method,  it  is  not  possible  to  distinguish  between  sensor  degradation  and 
degradation  of  the  components  used  to  test  it.  In  the  discussion  that  follows,  we 
will  use  the  term  calibration  in  the  weakest  sense  of  the  word  in  order  to  include 
the  widest  possible  array  of  calibration  methods  in  our  discussion. 


2.1.  Active  Self-Calibration 

9, 1  1  Mechanical  Actuators 

The  designs  of  sensors  based  on  capacitive,  piezoresistive,  or  piezoelectric 
sensing  of  a  moving  part  are  readily  adapted  to  built-in  calibration  and 
recalibration  of  the  displacement  transducer.  These  are  usually  a  surface  or  bulk 
micromachined  free-standing  membranes,  cantilevered  beams,  or  spring  systems 
and  are  used  in  many  pressure,  vibration,  acceleration  sensors.  Their  design  may 
be  modified  to  provide  a  range  of  electrostatic  forces  to  actuate  these 
displacement  transducers  and  then  to  use  an  associated  computer  to  generate  a 
calibration  table  from  the  measured  responses.  For  all  three  sensing  mechanisms, 
extra  electrodes  must  be  added  to  the  device  and  additional  engineering  is 
required. 

There  is  a  difference  between  calibration  check  and  recalibration.  In  the 
former,  a  control  circuit  (usually  the  onboard  ASIC)  compares  the  signal  output 
level  for  each  applied  voltage  level  to  a  stored  set  of  numbers.  If  the  comparison 
is  within  a  specified  limit,  then  the  device  is  in  calibration.  If  it  is  not,  then  the 
options  are  to  replace  the  sensor,  or,  to  store  a  new  set  of  numbers  and  thereby 
affect  a  recalibration.  However,  why  are  the  numbers  different?  Is  it  because  the 
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applied  standard  voltage  has  changed,  or  is  it  because  of  a  change  in  the  physical 
properties  of  the  piezoresistive  (piezoelectric,  capacitive)  read-out  device,  or  is  it 
because  of  a  change  in  the  stiffness,  or  the  bias  of  the  membrane  (cantilever, 
spring),  or  is  it  some  other  failure  mode?  Storing  a  new  set  of  numbers 
recalibrates  the  sensor  but  to  what  value?  The  only  true  way  to  recalibrate  the 
device  is  to  actually  apply  a  known  pressure,  acceleration,  etc.,  that  is  to  redo  the 
initial  calibration. 

2.1.2.  Electrical  Sensors 

For  sensors  that  operate  by  measuring  changes  in  current  or  voltage  in  a 
resistor  or  diode,  as  in  many  temperature  and  humidity  sensors  and  some 
pressure  sensors,  electrical  circuits  can  be  employed  in  some  cases  that  test  the 
operation  of  the  sensor.  It  is  also  recognized,  however,  that  certain  temperature 
and  humidity  sensors  are  inherently  difficult  to  calibrate  due  to  the  fact  that  a 
precise  voltage  reference  cannot  be  made  to  mimic  temperature  or  humidity. 
The  best  that  can  be  hoped  for  is  a  self-test  that  could  employ,  for  example,  a 
heater  to  eiffect  a  change  in  the  temperature  or  humidity,  which  is  recognized  by 
the  sensor.  This  indicates  that  the  sensor  is  working,  but  does  not  constitute  a 
calibration. 

It  is  anticipated  that  a  device  is  more  likely  to  fall  out  of  calibration  than  it 
is  to  fail  completely.  However,  technical  barriers  exist  for  the  calibration  of  these 
sensors.  Development  of  appropriate  calibration  methods  will  require  additional 
time,  since  it  is  not  clear  how  to  maintain  the  calibration  of  the  on-board  test 
circuitry  and  hardware  (which  require  additional  electrodes).  It  is  probable  that 
even  in  self  calibration-capable  MEMS,  certain  electrical  circuits  used  will  still 
rely  on  uncalibrated,  but  known-to-be-reliable  electronic  circuits  and  devices 
(such  as  constant  voltage  sources).  At  this  time,  we  do  not  know  of  any 
commercially  available  MEMS  sensors  that  allow  a  full  calibration  check  or  a 
recalibration,  but  it  is  an  active  area  of  research  in  the  MEMS  community  (The 
Analog  Devices  ADXL  accelerometer's  self-test  is  a  one  point  calibration  check). 
Although  this  is  clearly  a  very  desirable  feature,  it  is  not  clear  how  many  sensor 
types  are  being  researched  for  inclusion  of  self-calibration,  when  such  devices 
will  be  available,  or  what  the  cost  of  such  devices  will  be.  Pressure  and 
acceleration  sensors  are  most  amenable  to  potential  self-calibration  schemes. 

In  order  to  implement  1.1  or  1.2,  a  high  stability  voltage  reference  is 
required. 

2.1.3  Onboard  Voltage  and  Current  Standard 
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Small,  low-power,  band-gap  voltage  references  are  commercially  available 
for  less  than  a  dollar.  If  such  sources  have  adequate  reliability,  stability,  and 
precision,  then  sensor  circuitry  and  actuators  can  be  calibrated  with  such  voltage 
references.  Similarly,  commercial  constant  current  sources  are  available  with  a 
wide  variety  of  specifications  and  in  a  number  of  different  configurations.  Such 
devices  are  necessary  for  the  operation  of  diode-based  thermometers. 

2.1 .4  Transfer  of  Calibrated  Voltage  to  Device 

An  alternative  voltage  reference  was  suggested  by  Harold  Ghck.  A 
frequency-to-voltage  converter  can  be  used  to  generate  a  standard  voltage  from  a 
calibrated  frequency  sent  to  a  sensor.  That  voltage  could  then  serve  as  a 
reference  to  calibrate  a  device.  Clearly,  this  method  requires  the  reliability 
quaUfication  of  the  frequency-to-voltage  conversion  device. 

2.1.5  Reliability  of  Electronic  Circuits 

The  large  amount  of  data  on  reliability  of  CMOS  circuits,  and  the  vast 
experience  of  electrical  engineers  with  CMOS  circuits,  support  the  fact  that 
circuit  designers  are  very  comfortable  with  the  reliability  and  consistency  of 
various  electronic  circuits.  Such  designers  may  predict  that  electronic  portions  of 
self  calibration  schemes  do  not  need  to  be  calibrated  themselves,  once  they  are 
designed  and  tested.  Therefore,  solutions  2.1.3  or  2.1.4  would  not  be  necessary 
if  the  reliability  of  critical  CMOS  ASIC  circuits  that  control  MEMS  devices  can 
be  established. 


2.2  Active  Self-Test 

2.2.1  A  sensor  with  active  self-test  has  the  ability  to  determine  if  the 
device  is  functioning  correctly,  but  it  will  not  tell  you  if  the  calibration  is  wrong. 
At  best  it  indicates  that  the  sensor  should  be  changed.  The  exact  mechanism  used 
will  depend  on  the  specific  sensing  mechanism.  Prime  examples  are  electrostatic 
deflection  of  membrane,  cantilever  or  other  spring-based  pressure  and 
acceleration  sensors.  A  voltage  appled  to  the  extra  electrodes  produces  a  voltage 
from  the  readout,  or  provides  an  impulse  to  the  device  that  makes  the  membrane, 
cantilever  or  spring  “ring”  at  its  natural  frequency.  Other  examples  include  on- 
chip  heating  elements  for  temperature,  humidity,  and  chemiresistor  chemical 
sensors.  Strictly  speaking,  these  devices  do  not  allow  calibration,  but  they 
provide  an  indication  that  the  device  is  in  a  “normal”  operating  range  and  that  the 
signal  coming  from  the  device  is  “likely”  to  be  correct.  See  below  for  more 
discussion  of  what  “likely”  means.  Such  yes/no  self-test  features  should  be 
incorporated  into  the  initial  design. 
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2.3.  External  Stimulus 


2.3.1.  Natural 


An  example  of  this  is  barometric  pressure.  Calibration  is  performed  at  the 
times  of  high  and  low  pressure  that  naturally  occur  due  to  changing  weather 
patterns.  Readings  from  the  sensors  are  compared  to  a  single,  precision  pressure 
gauge. 

2.3.2.  Artificial 

2.3.2.1.  This  option  would  require  a  roving  worker  to  walk  around  the 
ship  with  a  ’test  instrument’  that  is  known  to  be  accurate,  and  manually  check 
each  sensor  on  some  periodic  schedule.  This  instrument  would  be  pre¬ 
programmed  to  do  all  the  necessary  test/calibration  tasks,  and  would  be  plugged 
in  to  each  sensor  (or  sensor  set)  to  verify  the  proper  operation  of  each  device. 
This  option  is  costly,  labor  intensive  and  time-consuming,  and  it  also  fails  to 
detect  malfunctions  between  testing  times.  It  is  the  primary  method  used  for 
today’s  shipboard  sensors. 

2.3. 2.2.  Stimulation  is  accomplished  by  placing  a  second  device  near  the 
sensor  that  is  centrally  controlled  and  can  be  remotely  ordered  to  conduct  the 
stimulus  test.  This  is  similar  to  1,  but  the  test  hardware  is  independent  of  the 
MEMS  sensor  package,  and  must  itself  be  calibrated.  It  too  is  a  complicated, 
costly  solution. 


3.  Redundancy  for  Reliable  Information 

3.1  Homogeneous  Redundancy  (Same  Sensing  Mechanism! 

Confidence  in  Calibration  can  be  assured  indirectly  by  using  several 
identical  sensors  to  measure  the  same  quantity.  The  signals  from  each  of  the 
sensors  are  inter-compared,  and  a  decision  protocol  determines  the  most  probable 
value  of  the  quantity  and  the  confidence  limits  for  that  value.  A  sensor  unit  can 
consist  of  in^vidual  sensors  packaged  together  and  controlled  by  an  ASIC,  or 
manufactured  together  at  the  chip  level  and  controlled  by  an  ASIC.  A  sensor 
array  is  replaced  when  the  confidence  is  less  than  satisfactory. 

3.2  Heterogeneous  Redundancy  (Different  Sensing  Mechanisms! 
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This  is  a  more  robust  form  of  redundancy,  similar  to  3.1  except  that  there 
are  two  or  more  sets  of  multiple  sensors,  and  each  set  operates  on  a  different 
physical  principle  in  order  to  measure  the  quantity  of  interest.  Examples  are 
given  in  Table  1  where  for  one  mechanism,  there  is  at  least  two  identical  sensors 
that  are  compared,  and  for  two  mechanisms,  there  is  at  least  one  of  each  type  of 
sensor  that  are  compared. 


Table  1  -  Some  types  of  redundant  sensor  membrane,  cantilever  or  spring  arrays. 


Sense 

mechanism 

Redundancy 

Option  I 

Option  II 

Option  ni 

Piezoresistive 

X 

X 

Capacitive 

X 

X 

Piezoelectric 

X 

X 

Heterogeneous  redundancy  avoids  a  potential  problem  with  homogeneous 
redundancy.  That  is,  it  is  possible  that  all  of  the  identical  sensors  of  a  given  set 
will  degrade  uniformly  (e.g.,  age  at  the  same  rate)  and,  therefore,  all  give  the 
same  but  erroneous  reading.  This  would  not  be  noticed  by  an  algorithm  that 
relied  in  comparison  between  sensors  of  a  given  sensor  set. 

If  the  performance  of  a  sensor  decreases  with  the  time  that  is  under  power 
in  both  3.1  and  3.2,  then  a  practical  use  of  the  sensor  arrays  could  include  the  use 
of  one  unit  of  an  array  as  the  primary  sensor,  and  the  others  used  to 
“occasionally”  confirm  the  correct  operation  of  the  primary  sensor.  This  method 
has  the  advantage  of  keeping  the  secondary  device  off-line  most  of  the  time,  and 
thus,  minimizing  the  chance  of  the  secondary  sensors  failing.  Redesigning  a 
standard  sensor  with  2  to  6  identical  sensors  on  a  chip,  instead  of  cutting 
individual  sensors  from  the  die,  is  a  straightforward  change  to  the  manufacturing 
process. 


4.  Certifying  and  Monitoring  Sensor  Stability 


Sensors  from  manufacturers  must  be  checked  to  ensure  that  they  meet  the 
specifications  when  initially  purchased,  and  after  sitting  on  the  shelf  for  many 
years.  This  is  especially  important  if  method  3  or  the  method  described  in  the 
next  paragraph  are  used  for  calibration  assurance.  In  addition  to  normal 
specifications  for  devices,  such  as  dynamic  range,  calibration  precision, 
sensitivity,  input  power,  frequency  response,  temperature  stability,  etc.,  it  is 
important  to  include  response  time  (how  long  does  it  take  the  sensor  to  notice  a 
stimulus). 

While  it  is  not  a  true  solution  to  the  problem  of  obtaining  reliable 
information  from  sensors,  it  is  worth  pointing  out  that  many  failures  can  be 
recognized  simply  by  comparing  current  data  to  previous  data  a  sensor  has 
generated.  If  the  output  suddenly  jumps  off  scale,  or  starts  behaving  erratically 
when  the  data  history  has  normally  been  a  smooth  and  steady  response,  this 
indicates  something  is  wrong,  and  that  the  sensor  should  be  changed.  Although 
the  method  is  simple,  it  may  be  appropriate  in  some  cases  where  the  sensor  output 
is  not  life  threatening.  It  is  also  a  very  low-cost  solution.  The  basis  for  this 
method  is  the  expected  stability  of  MEMS  sensors.  In  order  to  implement  this 
approach,  the  stability  of  each  sensor  used  would  have  to  be  determined.  This  is 
in  itself  challenging  because  life  tests  take  time  and  accelerated  testing  is  usually 
questionable. 


5.  Some  Practical  Issues 

Reliabihty,  lifetime,  and  calibration  go  hand-in-hand.  For  a  shipboard 
system  with  upwards  of  200,000  sensors  to  work  effectively,  it  must  have  long 
life,  be  simple  to  maintain  and  easy  to  repair  when  trouble  is  noted,  and  the 
information  it  provides  must  be  believable.  The  sensors,  by  definition,  must  be 
robust,  reliable,  and  within  the  calibration  specified  while  in  use.  A  practical 
way  to  handle  the  calibration  is  to  discard  a  sensor  whenever  parameters 
monitored  by  the  system  undergo  a  change.  Highly  calibration  stable  sensors 
could  be  handled  in  this  way.  What  is  required  is  sohd  engineering  data  on  the 
long-term  behavior  of  the  sensor,  and  good  quality  control  and  repeatability  from 
the  manufacturer. 

Since  the  promise  of  MEMS  is  inexpensive,  reliable  sensors,  and  since 
many  devices  or  circuits  can  be  packaged  together  on  the  chip  with  little  cost 
penalty,  redundancy  may  be  affordable.  Therefore,  redundancy  could  be  used 
extensively  to  enhance  not  only  calibration  accuracy,  but  sensor  array  lifetime  as 
well. 
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In  solving  the  calibration  problems,  one  should  always  search  for  the 
simplest  and  most  practical  solutions.  The  addition  of  sophistication  to  a  MMS 
IjQ\ygver,  may  be  a  practical  solution  in  some  cases.  The  additional 
hardw^e  and  software  only  have  to  be  designed  and  added  once.  The  device  may 
still  be  affordable  due  to  batch  processing. 

The  notion  that  all  sensors  must  have  calibration  traceable  back  to  NIST 
standards  is  an  admirable  goal.  However,  this  exacting  process  may  not  be 
practical,  achievable,  nr  even  necessary  in  order  to  carry  out  the  mission.  For 
example,  it  may  suffice  to  calibrate  against  NIST  standards  before  deployment, 
and  thereafter  look  for  a  change  in  the  operating  parameters. 

In  arriving  at  a  plan  for  the  successful  implementation  of  MEMS  sensors 
on  a  ship,  it  is  worthwhile  to  recall  the  advantages  of  MEMS  sensors.  A  MEMS 
device  consists  of;  1)  a  sensor/actuator,  2)  and  integrated  circuit.  MEMS 
technology  is  mainly  characterized  by  the  items  in  the  following  table: 


1  ADVANTAGES  OF  MEMS  1 

Main  Properties 

Miniaturization 

Arrays 

High  Resolution 

Main  Benefits 

New  Applications 

Cost  Effective  at  High  Volume 
(not  necessarily  cheap!) 

Leading-Edge  Performance 

Small  Size  and  Low  Power 

Multiple  Sensors  per  Package 

Nowhere  in  this  hst  is  the  word  “calibrated”  specifically  listed.  All  the 
listed  items  can  be  useful  to  the  program.  In  discussions  with  MEMS  experts,  we 
find  that  devices  with  factory  calibrated  output  over  their  operating  range  are 
relatively  expensive  versus  those  that  are  designed  to  give  yes/no  information. 
Here,  factory  calibrated  means  no  ability  to  self-calibrate  once  it  leaves  the 
factory. 
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This  type  of  information  prompts  two  graphs  that  summarize  the  cost- 
benefit  trade-off  for  calibrated  MEMS.  Tentative  versions  of  the  graphs  are 
given  below,  based  on  discussions  with  several  MEMS  researchers  and 
manufacturers. 


Figure  1:  Approximate  Cost  of  Volume-Produced  MEMS  Devices 


#  of  Units 


Figure  1  shows  that  for  low  cost,  batch  units  of  100,000  or  more  must  be 
built.  It  is  likely  that  for  a  device  with  temperature  compensated,  initially 
calibrated  output  guaranteed  by  the  manufacturer,  the  eost  will  be  ~$50  per 
sensor.  This  figure  is  tentative,  but  it  conveys  the  spirit  of  the  cost  difference 
between  simple  COTS  devices  and  more  complicated  MEMS  solutions  (~5x  more 
expensive). 
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Figure  2.  Device  Confidence  vs.  Unit  Cost 


Figure  2  suggests  a  criterion  for  acceptabiUty  of  the  complication  of  the 
delivered  MEMS  devices  versus  cost.  The  Figure  is  schematic  since  it  is  not  clear 
where  to  place  the  calibration  assurance  methods.  Rehability  refers  to  a  single 
reliable  sensor  in  a  MEMS  device  which  encompasses  most  of  the  present  day 
sensor  technology.  Redundancy  1  means  an  array  of  sinular  sensors 
(homogeneous  redundancy)  that  are  inter  compared.  Redundancy  2  me^s  two 
different  types  of  redundant  devices  operating  on  two  or  more  entirely  different 
physical  principles  (heterogeneous  redundancy)  which  are  also  intercomp^ed. 
Self-Test  means  an  uncalibrated  indication  from  the  device  that  is  working  within 
a  wide  specification  window,  and  Self-CaUbrate  indicates  that  the  device  is 
capable  of  remote  calibration.  The  simplest  of  &ese  solutions  that  can  solve  the 
mission  requirements  will  be  the  most  cost  effective. 
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6.  Conclusions  and  Recommendations 


In  the  following  discussion  we  argue  that  if  reliability  is  the  key  issue,  then 
redundancy  offers  superior  performance  relative  to  periodic  calibration. 

Current  practice  is  to  hand  carry  a  (traceable)  standard  to  each  instrument 
to  be  calibrated.  This  practice  identifies  an  instrument  that  has  already  gone  out 
of  calibration.  However,  calibration  does  nothing  to  insure  that  the 
instrument  will  not  fail  immediately  after  calibration.  Thus,  calibration 
by  itself  does  not  insure  that  any  later  reading  is  valid.  This  practice  serves 
mainly  to  validate  old  data  and  to  identify  those  instruments  that  have  failed  or 
fallen  out  of  calibration.  Assuming  we  have  a  MEMS  device  that  can  be  asked  to 
calibrate  itself,  one  still  has  to  rely  on  methods  3  or  4  above  to  determine  if  the 
device  is  giving  proper  information  in  between  calibrations. 

The  central  question  is  then:  Can  we  obtain  a  higher  confidence  in  data 
with  an  alternate  technique? 

One  alternate  technique  uses  an  array  of  instruments  (redundancy)  to 
determine  the  same  measurand.  The  high  cost  or  redundancy  may  have 
been  the  reason  that  it  has  not  been  widely  used.  However,  with  the  low 
cost  of  MEMS  arrays,  redundancy  is  now  cost  effective.  Moreover,  it  offers  a 
higher  degree  of  confidence  in  the  final  measured  values  than  any  other 
approach.  This  confidence  can  only  come  from  having  determined  a  quantity 
several  times  with  different  instruments.  Redundant  MEMS  instruments  can 
contain  arrays  of  sensors  and  can  be  significantly  less  costly  than  a  single  large 
scale  device. 

Thus,  in  order  to  insure  reliability  of  sensor  information,  we  propose  to 
replace  each  single  sensor  with  several  sensors,  all  of  which  perform  the  same 
function  (although  not  necessarily  in  same  way).  We  calibrate  these  at  the 
time  of  installation  and  thereafter,  we  infer  their  continued  state  of  calibration 
from  the  degree  of  agreement  between  their  individual  outputs.  That  is,  we 
simply  compare  their  responses  (at  the  same  time  and  for  the  same  input).  As 
long  as  all  instruments  are  healthy,  their  outputs  will  agree  to  within  some 
reasonable  uncertainty.  Then,  we  can  continue  to  rely  on  their  outputs.  Aging 
errors  of  individual  devices  will  be  uncorrelated  for  devices  based  on  different 
physical  principles.  Thus,  aging  phenomena  can  be  readily  identified  and 
tracked. 

If  the  output  of  a  sensor  or  class  of  sensors  begins  to  deviate  from  others  in 
the  array,  then  that  fact  can  be  transmitted  to  a  central  control  point  and 
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corrective  steps  can  be  taken.  However,  because  there  may  be  other  sensors  in 
the  array  that  still  agree  with  each  other,  a  high  level  of  confidence  in  the  sensor 
data  can  be  maintained  even  without  taking  any  corrective  steps.  This  is  an 
important  factor  in  a  battle  situation  where  repair  of  sensors  is  unavoidably 

delayed. 

Reliability  engineering  provides  a  well  established  formalism  for 
predicting  the  validity  of  the  output  of  an  array  of  sensors  working  in  parallel. 
This  can  be  quantified  in  terms  of  the  performance  factors  of  each  sensor  in  an 
array.  According  to  established  theory,  one  only  needs  to  specify  the  desired 
performance  requirements  (e.g.,  degree  of  agreement  between  ^ay  elements)  to 
determine  the  corresponding  requirements  to  place  on  the  individual  sensors 
within  that  array.  Once  this  is  established,  one  either  publishes  these 
requirements  as  a  guide  for  COTS  manufacturers,  or  one  performs  well- 
established  testing  techniques  to  evaluate  existing  COTS  products  to  determine 
how  many  sensors  will  be  required  to  meet  the  desired  confidence  limits.  An 
authority  on  the  reliability  of  electronic  devices  at  NRL  (Fred  Danz)  asserted  that 
there  are  even  ways  to  assess  the  confidence  limits  for  devices  that  exhibit  no 
failures  during  testing  (which  he  claims  is  very  common  event  with  today’s 
electronic  devices).  Details  are  available  in  a  MIL  Handbook  on  Reliability  for 
Electronics. 

This  scenario  seems  to  reduce  the  requirement  for,  or  the  utihty  of,  self¬ 
test  functions,  unless  it  is  necessary  to  evaluate  performance  over  a  wide  range  of 
inputs.  In  that  case,  the  input  to  a  sensor  array  must  be  simulated.  Self  test 
implemented  in  MEMS  only  approximates  this  solution. 

There  are  significant  technical  difficulties  and  expense  involved  in 
transferring  a  standard  (e.g.,  over  a  radio  link)  to  a  sensor.  For  example, 
additional  circuitry  must  be  designed  and  incorporated  into  sensor  syste^. 
Moreover,  as  stated  above,  the  only  standard  that  it  is  possible  to  transfer  is  time 
(or  time  increment).  In  any  case,  we  must  rely  upon  an  assumed  infallibility  of 
additional  devices  on-board  the  sensor  in  order  to  convert  the  transferred  time  to 
some  other  quantity  such  a  voltage.  Since  there  is  no  justification  for  assuming 
such  infallibility,  the  reliability  of  such  a  "pseudo  calibration"  is  limited. 

By  the  same  token,  one  must  treat  the  reliability  of  any  on-board 
references  with  equal  skepticism.  Furthermore,  even  if  one  succeeded  in 
affecting  such  a  transfer  of  a  standard,  it  is  not  clear  that  having  done  so  provides 
any  advantage  over  redundancy.  For  these  reasons,  we  believe  that  redundancy  is 
the  preferred  approach  to  achieving  the  maximum  attainable  reliability  of  sensor 
data,  and  that  it  can  be  accomplished  at  less  cost  per  increment  of  improved 
confidence  than  any  alternate  techniques.  Without  reliability  data,  it  is  not 
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possible  to  predict  whether  method  4  will  provide  the  required  combination  of 
lifetime  and  reliability  of  output,  so  method  3  is  recommended. 


After  canvassing  several  developers  and  sellers  in  the  MEMS  community 
about  how  to  handle  the  calibration/reliability  question  and  melding  their 
responses  with  our  own  research  and  ideas,  we  arrived  at  the  following  specific 
recommendati  ons : 

A.  Insistence  on  calibration  of  a  MEMS  device  is  impractical  in  many  cases 

It  may  be  too  costly  to  produce  a  device  that  can  be  calibrated  in  the  field. 

Complications  arise  in  assuring  calibration  of  the  on-board  hardware  and 
electronics  required  for  calibration. 

If  a  device  calibration  is  run  periodically,  there  is  no  assurance  that  is  will 
not  fall  out  of  calibration  before  the  next  calibration  check 

There  are,  at  present,  no  commercial  sources  of  BIC-MEMS  devices  and  it 
is  not  clear  when,  if  ever,  such  devices  will  be  available 

Reliability  and  longevity  of  Built-in  Calibration  devices  is  unknown 

B.  Redundancy  provides  the  highest  confidence  in  sensor  output. 

Using  arrays  of  devices,  coupled  with  reliability  engineering  principles, 
not  only  provides  instant  built-in  fault  detection,  but  it  also  permits  fully 
operational  status  to  continue  and  repairs  to  be  postponed.  This  capability 
is  essential  for  extensive  sensor  networks.  The  miniature  arrays  take 
advantage  of  new  capabilities  offered  by  MEMS. 

C.  Any  program  that  professes  to  provide  solutions  to  the  installation  of  200,000 
sensors  on  a  ship  should  use  sound  reliability  engineering  principles  and  employ 
individuals  with  reliability  engineering  training. 

D.  Without  MEMS  sensors,  the  ship-building  programs  should  be  prepared  to 
spend  over  $100  per  sensor  (includes  some  onboard  decision  making,  RF  links, 
and  power).  If,  however,  commercial  MEMS  jurays  become  available  euid  are 
used  extensively  with  sound  reliability  engineering  practice,  then  the  cost  might 
be  under  $10  per  sensor.  If  the  reliability  of  single  COTS  sensors  is  sufficient  to 
accomplish  the  mission  (method  4  above),  then  the  costs  will  be  somewhat  less. 
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E.  Keep  the  design  as  simple  as  possible,  and  ask  for  as  few  changes  as  possible 
from  an  existing  device  from  a  manufacturer. 

In  general,  this  means  that  the  micromechanical  machined  part  contains 
very  little  electronics  on  it,  and  the  electronic  signal  processing  is  handled 
by  a  ASIC  on  a  mating  part. 

F.  Actual  MEMS  devices  for  shipboard  apphcations,  in  order  to  keep  costs 
down,  will  entail  minor  modifications  to  devices  already  being  built  (nearly 
COTS). 

For  example,  arrays  of  devices  are  already  being  manufactured  on  a  chip,  but  are 
presently  packaged  as  individual  units.  Redesign  of  the  placement  of  devices  to 
form  small  arrays  is  not  too  expensive,  although  additional  costs  will  arise  due  to 
development  of  new  packaging  and  new  ASIC’s.  Developing  an  ASIC  is 
relatively  cheap  since  they  can  be  modeled  very  quickly  and  ASIC  technology  is 
very  agile  and  capable.  It  is  much  more  expensive  to  develop  new  MEMS  devices 
since  the  modeling  is  in  its  infancy.  Trial  and  error,  which  are  time  consuming 
and  costly,  are  still  a  large  part  of  new  device  development. 

G.  The  existing  Navy  infrastructure  responsible  for  the  reliability  of  sensors  on 
Navy  ships  should  be  tasked  with  the  responsibility  to  provide  reliability 
engineers  with  performance  data  on  candidate  MEMS  devices  that  can  be 
compared  to  the  output  of  reliability  models.  The  reliability  models  will 
determine  the  lifetime  required  of  the  devices  which  are  needed  to  enable  the 
implementation  of  the  extensive  sensor  system. 

The  responsibihties  include: 

-  routine  testing  of  as-received  devices  for  compliance  with  specifications  . 

-  accelerated  life-tests  on  batches  of  devices  for  reliabihty  modeling 

-  accumulation  of  shelf-hfe  data  on  sensors 

-  tracking  replacement  frequency  of  ship-board  sensors  to  compare  with 

models 

H.  Advanced  research  on  CMOS  devices  for  the  space  community  has  produced 
“low  voltage  electronics.”  We  recommend  a  6.2  research  program  to  support 

this  technology  in  a  MEMS  configuration,  because  of  its  potential  impact 
on  sensor  hfetime  and  rehabilitv  issues.  This  technology  is  potentially  very 
important  because  it  could  greatly  extend  the  battery  life  of  the  MEMS  device. 

The  new  low  voltage  (and  low  power)  technology,  still  in  its  infancy,  uses 
gate  voltages  of  one  volt  or  less.  The  resulting  circuits  consume  a  factor  of 
10  to  500  less  power  than  standard  CMOS  circuits.  There  appears  to  be  no 
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technical  barriers  for  implementing  control  ASICS  for  MEMS  devices 
using  this  new  technology.  The  primary  systems  issue  is  the  increased 
chance  of  upset  of  the  devices  from  electrical  noise  due  to  the  lower 
operating  voltages. 

I.  Low  Power  communications 

Since  RF  communication  could  consume  the  largest  of  the  power  required 
for  the  sensor  packages,  a  low  power  communications  technique,  such  as 
modulated  reflectance  scheme  for  RF  communication,  should  be 
considered.  Such  technologies  could  increase  even  further  the  very  long 
battery  life  enabled  by  the  new  low  voltage  electronics  technology. 
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•  Appendix  I  -  Selected  notes  on  discussions  with  MEMS  researchers 
and  manufacturers 

Andrew  Mason.  University  of  Michigan,  August ,  1 998 

Quotes:  “Once  an  error  has  been  detected  there  is  very  Uttle  you  can  do  except 
replace  the  sensor  (unless  the  device  is  capable  of  self-diagnosis).  It  may  be 
possible  to  plug  the  malfunctioning  device  into  a  test  chamber  that  would  either 
tell  you  the  device  has  failed  completely  or  would  recalibrate  the  device  if  it 
appears  to  be  working  fine,  but  this  is  not  a  simple  task  and  could  require  a  great 
deal  of  equipment  including  an  environmental  chamber  ...  to  generate  the  proper 

test  conditions.” 

“As  I  mentioned  earlier,  self-test,  self-calibration,  and  other  auto  diagnostic 
features  are  still  being  worked  on,  but  they  appear  to  be  a  few  years  away  from 
commercial  markets.  The  best  thing  you  can  do  now  is  buy  a  sensor  that  has  a 
proven  track  record  and  be  prepared  to  change-out  devices  that  fail.  In  the 
future,  as  we  add  more  and  more  electronics  to  sensors  and  sensor  systems  we 
may  get  to  the  point  where  a  device  can  accomplish  self  repair.  However,  due  to 
the  nature  of  the  sensor,  it  is  quite  difficult  to  accomplish  in  many  cases  (i.e.  how 
do  you  remotely  set  the  barometric  pressure,  humidity,  temperature,  etc.  so  that 
you  can  get  proper  test  points  for  on-chip  calibration?).  Self  repair  is  easier  on  a 
circuit  where  the  data  is  all  electronic,  but  with  a  sensor  the  data  is  ’physical’  and 
hard  to  duplicate  on-chip.” 


President  of  a  Eiironean  MEMS  Manufacturing  Company 

Quotes:  “Redundancy  is  the  way  to  go.  In  fact,  redundancy  using  two  different 
sensing  mechanism  would  be  better.” 

**My  company  sells  an  accelerometer  for  $7  that  is  a  toggle  -  (that  is,)  it  gives  a 
signal  above  a  set  threshold.  We  sell  a  continuous  output,  guaranteed  calibration 
accelerometer  also.  Mass  produced  it  would  cost  about  $50.  I  do  not  know  how 
reliable  it  is  as  there  is  no  data.  Of  course,  I  believe  it  will  be  very  good.” 

“We  sell  a  MEMS  device  for  use  in  Europe  that  reads  the  amount  of  hot  water 
used  and  RF  links  the  information  to  the  utility  company.  It  is  very,  very 
reliable,  or  the  utility  companies  would  not  use  it  to  generate  income.” 
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Appendix  II  -  General  Considerations  for  MEMS  Sensor  Systems 

Although  not  addressed  by  this  study,  we  urge  the  establishment  of  a 
standard  sensor  packaging,  a  standard  bus  structure,  and  a  standard 
communications  protocol  for  sensors.  This  would  allow  mix  and  match  of 
components  from  different  vendors  and  upgrading  capabilities  when  new  devices 
become  available. 

In  order  to  reduce  power  requirement  at  each  sensor  we  suggest  a 
communication  system  based  on  modulated  reflectance  of  RF  energy.  This  is  the 
same  technology  that  is  already  in  use  in  tagging  schemes  and  at  some  highway 
toll  booths.  Each  sensor  is  interrogated  by  a  burst  of  addressed  RF.  The  sensor 
responds  by  varying  the  impedance  of  its  antenna  and  in  this  way  varies  the 
reflected  energy.  Tlie  information  is  digitally  encoded  in  the  time  dependence  of 
the  reflected  signal.  Thus,  the  sensor  does  not  use  any  energy  used  to  generate 
RF,  it  simply  modulates  the  incoming  signal.  The  operation  of  this 
communication  method  is  similar  to  using  a  variable  reflectance  corner  cube 
reflector  to  extract  information  from  a  passive,  covert  listening  device  via  a  laser 
beam  or  microwave  signal. 

Appendix  HI  contains  simple  computations  that  indicate  that  battery  power 
is  a  marginal  solution  for  providing  sensor  power.  Battery  technology  is  not  yet 
advanced  to  ensure  >5  year  battery  life,  which  we  believe  is  minimally  required 
from  a  maintenance  and  reliability  point  of  view.  The  use  of  low-voltage- 
electronics  and  RF  modulation  may  allow  the  use  of  battery  power.  The  use  of 
battery-powered  devices  would  simplify  the  job  of  retrofitting  of  ships  with 
sensor  arrays  by  eliminating  wiring  harnesses.  For  new  ship  acquisition,  we 
believe  that  bulkhead  power  should  be  provided  for  the  sensor  arrays. 
Communication  could  be  accomplished  by  RF  using  the  bulkhead  power  lines  or  a 
second  companion  set  of  lines. 

The  proposed  network  of  RF  links  with  sensors  will  likely  meet  heavy 
opposition  from  those  concerned  about  the  RF  signatures  of  navy  ships.  One 
acceptable  option  may  be  to  operate  such  a  network  at  frequencies  in  an 
absorption  band  for  water  vapor.  This  would  confine  stray  signals  to  the  close 
proximity  of  the  ship. 

It  may  turn  out  that  bulk  micromachined  and  wafer-bonded  crystalline 
silicon  will  be  the  MEMS  manufacturing  methods  of  choice.  Tliese  devices  have 
inherently  greater  temperature  stability,  and  have  fewer  material  interfaces  than 
surface  micromachined  devices.  Fewer  materials  and  interfaces  may  translate 
into  greater  calibration  stability  and  life-time.  While  this  statement  seems 
reasonable,  there  is  presently  no  hard  data  to  that  confirm  it. 
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Appendix  III  -  Estimates  for  Sensor  Failure  and  Maintenance. 

A.  Acceptable  Failure  Rate 

Say  there  are  200,000  sensors  on  a  ship. 

Say  failure  rate  for  any  reason  is  1%  per  year. 

Then  2000  sensors  fail  per  year. 

8760  hours  per  year/2000  failures  =  4.4  hours  between  failures 

or  ~6  failures  per  day 

or  2  failures  per  shift  for  a  3-shift  24  hour  day. 

This  is  probably  the  most  failures  one  person  could  handle  since  it  may 
take  10  min.  to  several  hours  to  identify,  locate,  and  change  out  a  sensor, 
depending  on  its  location  and  usage. 

For  reduced  manning  of  ships,  assigning  more  than  one  person  to  the 
sensors  would  defeat  the  purpose  of  having  the  sensors  on  board  in  the  first  place, 
since  the  95  person  crew  is  already  assigned  important  functions  to  run  the  ship. 

This  estimate  indicates  that  1%  per  year  is  an  upper  limit  to  the  acceptable 
failure  rate,  and  that  0.1%  would  be  much  more  acceptable  for  mission 
accomplishment.  The  calculations  assume  a  uniform  failure  rate.  More  likely 
sensors  will  fail  in  bunches,  overwhelming  one  assigned  person. 

This  computation  highlights  the  tremendous  advantage  of  using  redundant 
arrays  of  MEMS  sensors,  because  such  sensor  arrays  can  continue  to  supply 
information  with  high  confidence  despite  the  failure  of  a  sensor  element.  This 
significantly  reduces  the  urgency  of  sensor  maintenance. 
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B.  Battery  replacement 

Say  the  average  battery  life  is  3  years. 

Say  is  takes  an  average  of  10  minutes  to  walk  to  a  compartment,  locate  a 
sensor  and  change  the  battery. 

Therefore,  in  one  8  hour  shift  one  person  can  change  480  min./shift/lO 
min./battery  =  48  batteries 

To  change  200,000  batteries  in  3  months  requires, 

200,000  batteries/48  batteries/shift  =  4167  shifts 

4167  shifts/270  shifts/3  months  =  15  persons  round  the  clock 

15  persons  x  3  shifts  =  45  persons  seven  days  per  week 

45  persons  is  50%  of  the  ships  crew  working  for  3  months  to  change  the 
batteries. 

From  this  calculation,  it  appears  that  a  >5  year  battery  life  is  an 
appropriate  target,  so  that  this  kind  of  manpower  effort  is  no  more  than  a 
roughly  twice-per-decade  event  during  refitting. 
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